CVE-2025-40363: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40363 is a Linux kernel vulnerability in the IPv6 Authentication Header (AH) output path (net/ipv6/ah6.c) caused by field-spanning memcpy operations that trigger kernel WARN_ON assertions via the fortify-string sanitizer. The issue affects the ah6_output() and ah6_output_done() functions, where extension headers are incorrectly copied to/from the 16-byte IPv6 address fields, causing writes beyond the field boundary. It was published on December 16, 2025, and affects Linux kernel versions from the initial commit (1da177e4c3f4) up to the patched stable releases (Feedly, EUVD). No CVSS score has been assigned at this time.

The root cause is an improper use of memcpy in ah6_output() and ah6_output_done() (net/ipv6/ah6.c, line 439) where a 40-byte copy is performed targeting the saddr field of the IPv6 header, which is only 16 bytes wide (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer). The kernel's fortify-string compile-time and runtime checks detect this as a field-spanning write and emit a WARN_ON splat: memcpy: detected field-spanning write (size 40) of single field "&top_iph->saddr". The warnings are technically false positives because the extension headers are intentionally laid out contiguously after the IPv6 header in memory; however, the fix separates the address and extension header copies and introduces helper functions to eliminate code duplication (Feedly).

The primary impact is kernel stability — the fortify-string warning can trigger a kernel WARN_ON during IPv6 IPsec AH packet processing, potentially causing log noise or, in hardened configurations, a kernel panic (BUG_ON). Systems using IPv6 with IPsec Authentication Headers are affected. There is no evidence of direct memory corruption or privilege escalation, as the underlying memory layout is intentional; the risk is primarily availability-related for systems relying on IPv6 AH-based IPsec (Feedly).

Patches have been backported to multiple stable Linux kernel branches. Fixed versions include: 5.4.302, 5.10.247, 5.15.197, 6.1.159, 6.6.117, 6.12.58, 6.17.8, and 6.18. Downstream distributions including Ubuntu (USN-8096-1/2/3/5), Debian LTS, Amazon Linux 2, Oracle Linux 8, and SUSE have issued updated kernel packages (Ubuntu Advisory, Debian LTS, Amazon Linux). Administrators should update to the latest patched kernel version for their distribution. As a temporary workaround, disabling IPv6 IPsec AH processing (if not required) can prevent the warning from triggering.

The vulnerability has received routine coverage from Linux security advisory aggregators and scanner vendors (Tenable/Nessus, Qualys), with no notable researcher commentary or significant social media discussion. Multiple downstream distributions have issued kernel updates addressing this and other kernel CVEs in batch advisories (Ubuntu Advisory, Debian LTS).